# List logs

> Search a project's logs, newest first. q finds lines holding all of its words, or a phrase in quotes. level narrows to levels (trace, debug, info, warn, error, fatal, comma-separated); trace_id and request_id to one trace's or one request's lines; environment, service and deployment_id to where they ran; from and to to a period.

<div class="g1t-endpoint"><span class="g1t-method" data-method="get">GET</span><code>/workspaces/{workspace}/projects/{project}/observability/logs</code></div>

Each line has its time_us, severity, body, attributes, trace_id, span_id and request_id. A page holds limit; pass next back as cursor for the next. Needs a role on the project's repository.

`q` finds lines holding all of its words, or a phrase in quotes. `level` takes one or more of `trace`, `debug`, `info`, `warn`, `error` and `fatal`. Follow `trace_id` to [the trace](/reference/api/observability/get-trace/) or `request_id` to [the request](/reference/api/observability/get-request/).

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`observability`](/reference/mcp/#observability) with `action` `logs`, and the same inputs
- **Scope:** An access token needs [`observability:read`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's slug, e.g. "flagon-io". |
| `project` | string | Yes | The project's slug, as in g1t.sh/{workspace}/{project}. |

## Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `from` | string | No | The start of the period: an RFC 3339 time or Unix milliseconds. 24 hours before `to` unless you say. |
| `to` | string | No | The end of the period: an RFC 3339 time or Unix milliseconds. Now unless you say. |
| `q` | string | No | Words to find, all of them, or a phrase in quotes. |
| `level` | string | No | Only these levels: trace, debug, info, warn, error or fatal, comma-separated. |
| `trace_id` | string | No | Only the lines written under this trace. |
| `request_id` | string | No | Only the lines this request wrote. |
| `environment` | string | No | Only what ran in this environment, such as production or preview; several comma-separated. |
| `service` | string | No | Only what this service sent (OpenTelemetry's service.name; an app on g1t.page is its project's name); several comma-separated. |
| `deployment_id` | string | No | Only this deployment's (dpl_…). |
| `cursor` | string | No | Where to carry on from: the last page's `next`. |
| `limit` | integer | No | How many a page holds. |

## Example request

```sh
curl "https://api.g1t.sh/workspaces/flagon-io/projects/g1t/observability/logs?q=%22failed%22&level=error%2Cfatal&limit=1" \
  -H "Authorization: Bearer $G1T_TOKEN"
```

## Example response

A successful request answers `200` with:

```json
{
  "items": [
    {
      "id": "log_01kq9b7d9f1h3k5m7p9r1t3v5y",
      "time_us": 1791813808251000,
      "severity": "error",
      "severity_number": 17,
      "body": "loading pull request 412 failed: Cannot read properties of undefined (reading 'head')",
      "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
      "span_id": "00f067aa0ba902b7",
      "request_id": "req_01kq9b7d9f1h3k5m7p9r1t3v5x",
      "attributes": {
        "code.function": "loadPull",
        "http.route": "/:workspace/:repo/pulls/:number"
      },
      "service": "g1t-web",
      "environment": "production",
      "deployment_id": "dpl_01kq9a2c4e6g8j0m2p4r6t8v0x",
      "commit_sha": "7c1e9a4b2d6f80135ac9e2b7d4f6a8c0e1b3d5f7",
      "source": "cloudflare"
    }
  ],
  "next": null
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |